★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 312-50 Exam Dumps (PDF & VCE):
Available on: https://www.certleader.com/312-50-dumps.html


Exam Code: 312-50 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: Ethical Hacking and Countermeasures (CEHv6)
Certification Provider: EC-Council
Free Today! Guaranteed Training- Pass 312-50 Exam.

2021 Mar 312-50 latest exam

Q291. Eve is spending her day scanning the library computers. She notices that Alice is using a computer whose port 445 is active and listening. Eve uses the ENUM tool to enumerate Alice machine. From the command prompt, she types the following command. 

For /f "tokens=1 %%a in (hackfile.txt) do net use * \\10.1.2.3\c$ /user:"Administrator" %%a 

What is Eve trying to do? 

A. Eve is trying to connect as an user with Administrator privileges 

B. Eve is trying to enumerate all users with Administrative privileges 

C. Eve is trying to carry out a password crack for user Administrator 

D. Eve is trying to escalate privilege of the null user to that of Administrator 

Answer: C

Explanation: Eve tries to get a successful login using the username Administrator and passwords from the file hackfile.txt. 


Q292. Global deployment of RFC 2827 would help mitigate what classification of attack? 

A. Sniffing attack 

B. Denial of service attack 

C. Spoofing attack 

D. Reconnaissance attack 

E. Prot Scan attack 

Answer: C

Explanation: RFC 2827 - Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing 


Q293. In what stage of Virus life does a stealth virus gets activated with the user performing certain actions such as running an infected program? 

A. Design 

B. Elimination 

C. Incorporation 

D. Replication 

E. Launch 

F. Detection 

Answer: E


Q294. The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. From the options given below choose the one best interprets the following entry: 

Apr 26 06:43:05 [6282] IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) 

Interpret the following entry: 

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107.53 

A. An IDS evasion technique 

B. A buffer overflow attempt 

C. A DNS zone transfer 

D. Data being retrieved from 63.226.81.13. 

Answer: B

Explanation: The IDS log file is depicting numerous attacks, however, most of them are from different attackers, in reference to the attack in question, he is trying to mask his activity by trying to act legitimate, during his session on the honeypot, he changes users two times by using the "su" command, but never triess to attempt anything to severe. 


Q295. Henry is an attacker and wants to gain control of a system and use it to flood a target system with requests, so as to prevent legitimate users from gaining access. What type of attack is Henry using? 

A. Henry is executing commands or viewing data outside the intended target path 

B. Henry is using a denial of service attack which is a valid threat used by an attacker 

C. Henry is taking advantage of an incorrect configuration that leads to access with higher-than-expected privilege 

D. Henry uses poorly designed input validation routines to create or alter commands to gain access to unintended data or execute commands 

Answer: B

Explanation: Henry’s intention is to perform a DoS attack against his target, possibly a DDoS attack. He uses systems other than his own to perform the attack in order to cover the tracks back to him and to get more “punch” in the DoS attack if he uses multiple systems. 


Far out 312-50 exam cost:

Q296. What is the proper response for a NULL scan if the port is open? 

A. SYN 

B. ACK 

C. FIN 

D. PSH 

E. RST 

F. No response 

Answer: F 

Explanation: A NULL scan will have no response if the port is open. 


Q297. You are sniffing as unprotected WiFi network located in a JonDonalds Cybercafe with Ethereal to capture hotmail e-mail traffic. You see lots of people using their laptops browsing the web while snipping brewed coffee from JonDonalds. You want to sniff their email message traversing the unprotected WiFi network. 

Which of the following ethereal filters will you configure to display only the packets with the hotmail messages? 

A. (http contains “hotmail”) && ( http contains “Reply-To”) 

B. (http contains “e-mail” ) && (http contains “hotmail”) 

C. (http = “login.passport.com” ) && (http contains “SMTP”) 

D. (http = “login.passport.com” ) && (http contains “POP3”) 

Answer: A

Explanation: Each Hotmail message contains the tag Reply-To:<sender address> and “xxxx-xxx-xxx.xxxx.hotmail.com” in the received tag. 


Q298. Exhibit: * Missing* 

Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a trojan-port number database on the Internet. Identify the remote server's port number by decoding the packet? 

A. Port 1890 (Net-Devil Trojan) 

B. Port 1786 (Net-Devil Trojan) 

C. Port 1909 (Net-Devil Trojan) 

D. Port 6667 (Net-Devil Trojan) 

Answer: D

Explanation: From trace, 0x1A0B is 6667, IRC Relay Chat, which is one port used. Other ports are in the 900's. 


Q299. Kevin is an IT security analyst working for Emerson Time Makers, a watch manufacturing company in Miami. Kevin and his girlfriend Katy recently broke up after a big fight. Kevin believes that she was seeing another person. Kevin, who has an online email account that he uses for most of his mail, knows that Katy has an account with that same company. Kevin logs into his email account online and gets the following URL after successfully logged in: http://www.youremailhere.com/mail.asp?mailbox=Kevin&Smith=121%22 Kevin changes the URL to: http://www.youremailhere.com/mail.asp?mailbox=Katy&Sanchez=121%22 Kevin is trying to access her email account to see if he can find out any information. What is Kevin attempting here to gain access to Katy's mailbox? 

A. This type of attempt is called URL obfuscation when someone manually changes a URL to try and gain unauthorized access 

B. By changing the mailbox's name in the URL, Kevin is attempting directory transversal 

C. Kevin is trying to utilize query string manipulation to gain access to her email account 

D. He is attempting a path-string attack to gain access to her mailbox 

Answer: C


Q300. What are the limitations of Vulnerability scanners? (Select 2 answers) 

A. There are often better at detecting well-known vulnerabilities than more esoteric ones 

B. The scanning speed of their scanners are extremely high 

C. It is impossible for any, one scanning product to incorporate all known vulnerabilities in a timely manner 

D. The more vulnerabilities detected, the more tests required 

E. They are highly expensive and require per host scan license 

Answer: AC